In order for a HIPAA violation to have occurred, the tweets would probably need to have contained so-called protected health information that was “individually identifiable” about Johnson. At a glance, the tweets may not meet that test, according to experts.

“That's hard to say because blood and gore is not PHI in and of itself,” Ice Miller LLP partner Kim Metzger said.

But Metzger added that certain details in Runtz’s alleged tweets — the location, the time of day, the bloody room, the patient’s death and an allegation that Johnson’s family members attacked hospital staff — could be sufficient to connect the dots and make it clear about whom she was tweeting.